cookie header now inspects Set-Cookie headers as well

src/detect-engine-hcd.c

@@ -88,12 +88,22 @@ int DetectEngineRunHttpCookieMpm(DetectEngineThreadCtx *det_ctx, Flow *f,
         if (tx == NULL)
             continue;
 
-        htp_header_t *h = (htp_header_t *)table_getc(tx->request_headers,
+        htp_header_t *h = NULL;
+        if (flags & STREAM_TOSERVER) {
+            h = (htp_header_t *)table_getc(tx->request_headers,
                                            "Cookie");
             if (h == NULL) {
                 SCLogDebug("HTTP cookie header not present in this request");
                 continue;
             }
+        } else {
+            h = (htp_header_t *)table_getc(tx->response_headers,
+                                           "Set-Cookie");
+            if (h == NULL) {
+                SCLogDebug("HTTP Set-Cookie header not present in this request");
+                continue;
+            }
+        }
 
         cnt += HttpCookiePatternSearch(det_ctx,
                                        (uint8_t *)bstr_ptr(h->value),
@@ -153,12 +163,22 @@ int DetectEngineInspectHttpCookie(DetectEngineCtx *de_ctx,
         if (tx == NULL)
             continue;
 
-        htp_header_t *h = (htp_header_t *)table_getc(tx->request_headers,
+        htp_header_t *h = NULL;
+        if (flags & STREAM_TOSERVER) {
+            h = (htp_header_t *)table_getc(tx->request_headers,
                                            "Cookie");
             if (h == NULL) {
                 SCLogDebug("HTTP cookie header not present in this request");
                 continue;
             }
+        } else {
+            h = (htp_header_t *)table_getc(tx->response_headers,
+                                           "Set-Cookie");
+            if (h == NULL) {
+                SCLogDebug("HTTP Set-Cookie header not present in this request");
+                continue;
+            }
+        }
 
         det_ctx->buffer_offset = 0;
         det_ctx->discontinue_matching = 0;